feat: backend scaffold (FastAPI app, /api/v1/health, /api/v1/echo, sessions)

[constk]

Problem

The harness needs a minimal Python service to exercise it: an empty src/ makes import-linter, mypy, and FastAPI test patterns unverifiable.

Proposed solution

Build src/api/main.py (FastAPI app, CORS middleware, lifespan), src/api/routes.py (GET /api/v1/health returning a HealthResponse Pydantic model; GET /api/v1/echo?msg=... returning the message wrapped in a StrictModel), src/api/sessions.py (in-memory session dict + helpers; portable pattern). One pytest using FastAPI TestClient for each endpoint.

Acceptance criteria

• uv run uvicorn src.api.main:app --reload boots without errors.
• curl localhost:8000/api/v1/health returns 200 with shape {"status": "ok", "version": "0.1.0"}.
• curl 'localhost:8000/api/v1/echo?msg=hi' returns {"echoed": "hi"}.
• pytest tests/test_api.py passes; coverage of src/api/ >= 90%.
• All routes prefixed with /api/v1/ (invariant 7 in docs/INVARIANTS.md after docs: HARNESS, INVARIANTS, BOUNDARIES, DEVELOPMENT, EVAL_HARNESS, SECURITY, ARCHITECTURE skeletons #25).

Priority rationale

Critical: without a working app, downstream tickets (observability, eval, frontend) have nothing to wire to.

Depends on

#2